IDA startup signatures format

Question

IDA startup signatures are sets of signatures used in FLIRT to detect what library is used in a static linked executable .
I am about to use these signatures to detect which library is used in an executable file .
I must use pattern files in IDA FLAIR in startup folder .
but i don't know it's format and what does each field mean (:?)
here are a few sample pattern :

1)8BFF558BECE8........E8........5DC3.............................. 00 0000 0011 :0000 s=A/- ^0006 ___security_init_cookie ^000B ___tmainCRTStartup
2)6A0C68........E8........8BF98BF28B5D0833C0408945E485F6750C3915.. 00 0000 00F6 :0000 o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+67^[_DllMain@12]~msmfc2d/~@vc32mfc@; :00E4@ $LN18 :00E3@ $LN25 :00D3@ $LN29 :00D3@ $LN17 ^0003 __sehtable$___DllMainCRTStartup ^0008 __SEH_prolog4 ^001F ___proc_attached ^0037 __pRawDllMain ^0055 __CRT_INIT@12 ^0068 _DllMain@12 ^00DD ___CppXcptFilter ^00F1 __SEH_epilog4 ......0F84C50000008365FC003BF0740583FE02752EA1........85C07408575653FFD08945E4837DE4000F8496000000575653E8........8945E485C00F8483000000575653E8........8945E483FE01752485C07520575053E8........576A0053E8........A1........85C07406576A0053FFD085F6740583FE037526575653E8........85C075032145E4837DE4007411A1........85C07408575653FFD08945E4C745FCFEFFFFFF8B45E4EB1D8B45EC8B088B095051E8........5959C38B65E8C745FCFEFFFFFF33C0E8........C3

i could 't find any relevant content on the internet. can any body help me about the format?
More about my need:
I want to find library functions in PE files (on my own program not by IDA) and ,as there are a huge amount of FLAIR pattern for all libraries , I cannot load them altogether because of memory and speed issues .
I have also read pat.txt in IDA FLAIR and i know the patterns format but startup signatures format is a bit different and has new parts so I want to know about these new parts like : o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+67^[_DllMain@12]~msmfc2d/~@vc32mfc@;

Answer 1

First, you should begin by reading through pat.txt which is included with the IDA flair utilities. It describes the format of .pat files.

Second it would be helpful if you can clarify what you are trying to do. What processor/file type are you working with? In many cases you do not need to directly manipulate .pat files at all since Hex-Rays provides tools to generate .pat files and .sig files from those .pat files.

Third, it is not clear exactly what type of signatures you are trying to work with and why. IDA "startup" signatures are a special form of signature used the when you first create a database for a new binary file. The purpose of startup signatures is to identify startup routines and the compiler used to create the binary. This may in turn trigger the loading of additional library signature files. Library signature files are the ones used to recognize the presence of library code that has been statically linked into a binary. Signatures are usually generated by parsing a copy of the static link libraries that were linked into the binary you are interested in. The most common case for needing to understand the .pat file format is when the parsers that Hex-Rays ships with flair are not capable of parsing the link libraries that you are trying to create patterns from.

This link may also be useful: Hex-Rays FLIRT